How to create an additional NetWitness swap file?

[#1]

Article Number

000039768

Applies To

RSA Product Set: RSA NetWitness Platform
RSA Version/Condition: 11.5.x, 11.6.x
Platform: CentOS
O/S Version: 7

Issue

NetWitness keeps running out swap file space, how to create more swap?

The default NetWitness swap partition 4GB keeps running low.

Have tried everything to reduce the memory usage on the NetWitness appliance, but need more swap space.

Resolution

Swap space can take the form of either a dedicated swap partition or a swap file.

The default NetWitness install creates a 4GB swap partition.

Can create an additional swap file on a mount with free disk space and then add this file as an extension to the existing swap partition.

If available, creating the new swap file on an SSD mount will provide better performance than on a hard disk mount.

Recommend creating a 4GB swap file, and no more than double the physical memory size.

Swap space will always perform slower than physical memory.
 

Creating a swap file

1. Create a 4GB file that will be used as a swap.
   fallocate -l 4G {path}/swapfile
   
   For example:

   
   fallocate -l 4G /home/do-not-delete/swapfile

   
   Or if the above command fails.
   
   dd if=/dev/zero of={path}/swapfile bs=1K count=4M
   
   Substitute {path}/swapfile with a suitable path and filename.
    
2. Give the created swap file read and write permission to the root user.

   
   chmod 600 /home/do-not-delete/swapfile

3. Format the file as a swap file.

   
   mkswap /home/do-not-delete/swapfile

4. Add the new swap file as an addition to the existing swap partition.

   
   swapon /home/do-not-delete/swapfile

5. Add the new swap file to the /etc/fstab file.
   Edit the /etc/fstab file and add the following line.
    

   
   /home/do-not-delete/swapfile swap swap defaults 0 0

6. Confirm the new swap file is active.

   
   [root@NW ~]# swapon --show
   NAME                         TYPE      SIZE USED PRIO
   /dev/dm-11                   partition   4G   4G   -2
   /home/do-not-delete/swapfile file        4G   4G   -3
   
   [root@NW ~]# free -h
                 total        used        free      shared  buff/cache   available
   Mem:            33G         32G        239M         12M        446M        316M
   Swap:          8.0G        8.0G         76K

   
   
    

 

Notes

Remove the swap file

1. Stop using the swap file

swapoff {path}/swapfile

For example:

swapoff /home/do-not-delete/swapfile

Substitute {path}/swapfile with a suitable path and filename.

2. Delete the swap file to free up the disk space
 

rm /home/do-not-delete/swapfile

3. Remove the swap file entry from the /etc/fstab file
Edit the /etc/fstab file and remove the following line.
 

/home/do-not-delete/swapfile swap swap defaults 0 0

6. Confirm the swap file is removed
 

[root@NW ~]# swapon --show
NAME       TYPE      SIZE USED PRIO
/dev/dm-13 partition   4G   0B   -2

[root@NW ~]# free -h
              total        used        free      shared  buff/cache   available
Mem:            33G         11G         13G        129M        7.9G         21G
Swap:          4.0G          0B        4.0G